From b2d0643d9afc6e584a2e84e8c77c1cab597bb964 Mon Sep 17 00:00:00 2001
From: Neko Ayaka <neko@ayaka.moe>
Date: Mon, 23 Mar 2026 19:16:52 +0800
Subject: [PATCH] fix(ci): re-calculate Windows artifact hash

Authored-by-agent: Codex <267193182+codex@users.noreply.github.com>
---
 .github/workflows/release-tamagotchi.yml | 26 ++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/.github/workflows/release-tamagotchi.yml b/.github/workflows/release-tamagotchi.yml
index 9f9b7996d..d06df31b0 100644
--- a/.github/workflows/release-tamagotchi.yml
+++ b/.github/workflows/release-tamagotchi.yml
@@ -265,6 +265,15 @@ jobs:
           path: apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }}
           overwrite: true
 
+      # NOTICE: Electron Builder generates latest.yml during the build step, before this workflow
+      # submits the Windows installer to SignPath. SignPath re-signs the .exe and changes its bytes,
+      # which changes the updater hashes too. Regenerating latest.yml from the signed installer keeps
+      # the published Windows update metadata aligned with the final released artifact.
+      - name: Regenerate Windows latest.yml (Nightly + Windows Only)
+        if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' }}
+        run: |
+          pnpm -F @proj-airi/stage-tamagotchi run regenerate-windows-latest --input apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }} --output apps/stage-tamagotchi/bundle/latest.yml --version ${{ env.VERSION }}
+
       # ---------
       # Workflow Dispatch only
       # ---------
@@ -358,6 +367,14 @@ jobs:
           path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}
           overwrite: true
 
+      # NOTICE: Electron Builder already wrote latest.yml before SignPath signed the installer.
+      # After the signed .exe replaces the unsigned one, we must rebuild latest.yml so its hashes
+      # describe the final Windows artifact that users will actually download.
+      - name: Regenerate Windows latest.yml (Manual + Windows Only)
+        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && matrix.os == 'windows-latest' }}
+        run: |
+          pnpm -F @proj-airi/stage-tamagotchi run regenerate-windows-latest --input apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }} --output apps/stage-tamagotchi/bundle/latest.yml --version ${{ env.VERSION }}
+
       - name: Upload To GitHub Releases (Manual + Release + Overwrite Release)
         if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && !inputs.artifacts_only }}
         uses: softprops/action-gh-release@v2
@@ -426,6 +443,15 @@ jobs:
         run: |
           Move-Item -Force apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }} apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}
 
+      # NOTICE: The root cause here is the build/signing order: latest.yml is produced by Electron
+      # Builder before SignPath re-signs the installer. That post-build signing step mutates the .exe,
+      # so the updater metadata becomes stale. Recomputing latest.yml after the signed file is moved
+      # into its final bundle path makes the release upload self-consistent again.
+      - name: Regenerate Windows latest.yml (Automatic + Windows Only)
+        if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' }}
+        run: |
+          pnpm -F @proj-airi/stage-tamagotchi run regenerate-windows-latest --input apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }} --output apps/stage-tamagotchi/bundle/latest.yml --version ${{ env.VERSION }}
+
       - name: Upload To GitHub Releases (Automatic)
         if: ${{ github.event_name == 'release' }}
         uses: softprops/action-gh-release@v2